“AT&T also acknowledged the customer records were exposed in a cloud database that was protected only by a username and password (no multi-factor authentication needed).”
Call and text records for about 110 million people sat in a Snowflake workspace behind one password. Some records include the nearest cell tower, which places the phone. AT&T told the SEC the breach is unlikely to materially hurt its finances, after a quarter with more than $30 billion in revenue. That filing explains why nobody bothered with multi-factor.